Be careful with regex! I had to disable regex condition in Advanced Content Filtering. Because sometimes (daily) some emails (with big MS office attachment) had been stucked in transport queue for >10 minutes! And a lot of warnings "Event ID 1050 source:MSExchange Extensibility (The execution time of agent 'GfiAvRoutingAgent' exceeded 90000 milliseconds while handling)" had been written in Application Event Log.